A company providing either exchange or custodial services for virtual currencies (“Custodians”) may find itself with custody of hundreds of millions of dollars’ worth of consumer digital assets. Custodians often possess the private keys that allow transfer of consumer funds and provide cybersecurity controls to prevent others from gaining that ability to transfer. When their consumers forget about their funds, Custodians may have the responsibility to report or deliver unclaimed virtual currency to a state agency.
This final obligation may surprise Custodians, but nearly every state has a version of unclaimed property law (“UPL”) that could govern virtual currencies within a Custodian’s control. This fact alone should not worry Custodians too much – it is simple enough to comply with a state’s UPL on a going-forward basis by implementation of targeted operational procedures.
Custodians should be concerned by the actions of state regulators and private plaintiffs. That is, state agencies have authority to enforce violations of UPLs. And private plaintiffs might use a prior violation of a state’s UPL as a basis for a time-consuming and expensive class action suit.
The three case studies below provide examples of such actions, whether brought at the level of state enforcement or private plaintiffs. In the private actions, plaintiffs use state UPL violations as the basis to claim a violation of a different state law, and sue for relief under that second law. Because of these innovative legal causes of action, Custodians must be wary not only of enforcement action from the states, but also of consumer-led actions advancing innovative legal thinking.
Case Study One: Multi-state Enforcement
Several states have pursued unclaimed property quite aggressively in the past, which can be a significant source of revenue for those states. As a result, businesses with unclaimed property who underreport, fail to report, or fail to hand over unclaimed property to the proper state may be exposed to state enforcement.
In 2016, Pennsylvania sued both Moneygram and the state of Delaware for $10.3 million in uncashed checks escheated to Delaware. Twenty-eight other states joined Pennsylvania to challenge Delaware’s claim over the unclaimed property. The question, still unresolved, is which state has the right to escheat the uncashed Moneygram checks. This ongoing dispute demonstrates the high stakes states place on the proper receipt of unclaimed property.
Case Study Two: California’s Unfair Business Practices Law
As of 2019, California is sitting on $9.3 billion in unclaimed property. California is one of the few states that automatically assesses a 12% late interest charge on companies that fail to report unclaimed property in time. Like most other states, California has an unfair business practices (“UBP”) law, intended to prohibit unlawful or unfair business acts or practices. Under California’s version of its UBP law, a civil complainant who has lost money or property as a result of a business’s unlawful or unfair business practices can initiate a private action against the business.
Faase v. Coinbase involved such a private action. In that case, a private party sued Coinbase for a violation of the California UBP law, claiming the failure to comply with California’s UPL constituted an unlawful business practice in violation of the state’s UBP law. The plaintiffs separately argued that failure to notify owners that Coinbase was holding property on their behalf, and the failure to deliver the property to the plaintiff or the applicable state constituted unfair business practices. While the case was voluntarily dismissed by the plaintiffs, Coinbase has since updated its User Agreement with a new clause addressing unclaimed property.
Case Study Three: Delaware’s False Claims Act and Its Qui Tam Provision
Delaware is the largest custodian of unclaimed property in the U.S., a consequence of it being the state of incorporation for over a million companies. Like most other states, Delaware has a false claims act (“FCA”) modeled on the federal False Claims Act to protect state programs from fraud. Under Delaware’s FCA, companies are liable for knowingly making, using or causing to be made a false record or statement that is material to an obligation to pay the government or for having possession, custody or control of property to be used by the government and knowingly delivering less than all of that property. For example, a business that knowingly underreports the value of unclaimed property owed to the state of Delaware, or that fails to deliver what it knew to be the true value of unclaimed property owed to the state of Delaware could be in violation of the state’s FCA.
Delaware’s FCA also includes qui tam provisions. These provisions allow private individuals with knowledge of fraud committed against the state to bring claims on behalf of the state and receive a share of the damages or financial penalties recovered as a reward for bringing the action, if successful. In State ex rel. French v. Card Compliant et al., a private plaintiff used the qui tam provision to sue 27 retailers, claiming it violated Delaware’s UPL and such violations constituted a violation of the state’s FCA. After more than four years of litigation, a jury returned a verdict against the remaining defendant finding that the defendant violated Delaware’s FCA by not reporting the balances of unredeemed gift cards to the state as unclaimed property.
The Supreme Court’s Priority Rules
Where the property, creditor, and debtor are located in different states, it is not always clear which state has the right to take custody of unclaimed property (the “Escheat Right”). States may have versions of the UPL that lead to conflicting results. The Supreme Court has been forced in a series of cases to establish “priority rules” to settle inter-state disputes.
Under the primary rule, the Escheat Right belongs to the state of the last known address of the owner or creditor. If there is no address recorded, then a secondary rule applies, that the Escheat Right belongs to the debtor or the business’s state of corporate domicile.
Custodians within the U.S. tend to request addresses as part of their onboarding process. Thus, the primary rule (Escheat Right goes to the state of the user) will generally apply, and such businesses will need to familiarize themselves with the state UPLs of every state they operate in to ensure compliance.
Some state statutes allow the state to audit the books and records of a business for compliance with the state’s UPL. Custodians may be subject to penalties and interest following an audit examination if they are found to have been deficient with their compliance with the UPL. The case studies above highlight that Custodians may also be subject to legal proceedings brought by private parties under a combination of a state’s UPL and their False Claims Act or unfair competition laws.
In Part Two, we look at how state UPLs might apply to scenarios specific to virtual currencies and what businesses might do to mitigate liability in these scenarios.